CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WP RealEstate plugin for WordPress, used by the Homeo theme, is vulnerable to privilege escalation in all versions up to, and including, 1.6.26. This is due to insufficient role restrictions in the 'process_register' function. This makes it possible for unauthenticated attackers to register an account with the Administrator role.
Explanation of Vulnerability in Simple Terms
WP RealEstate versions 1.6.26 and earlier contain a privilege management flaw that allows unauthenticated attackers to gain full control of the site without user interaction. The vulnerability affects all versions from release, and no patch information is currently available. Site administrators should immediately disable the plugin and contact ApusThemes for a security update.
What an attacker can do
Read, modify, or delete any site data; run their own code on the site; create admin accounts.
Potential impact on your site
Complete compromise of the WordPress site, including data theft, malware injection, and loss of admin control.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
